Rep add [eax+ecx], bl repeating one times.

Index > Main > Rep add [eax+ecx], bl repeating one times.

Author

Thread

Roman

Joined: 21 Apr 2012
Posts: 1939

Roman 08 May 2023, 05:54

I found rep add.
I try

Code:

mov ecx, 11
mov eax, text
mov bl, 48
rep add [eax+ecx], bl

Ida Pro show rep add [eax+ecx], bl
But commited one times, but not 11 times.
Why ?

08 May 2023, 05:54

macomics

Joined: 26 Jan 2021
Posts: 1155
Location: Russia

macomics 08 May 2023, 06:29

The rep prefix only works with string commands movs/stos/lods/ins/outs.

08 May 2023, 06:29

FlierMate2

Joined: 21 Mar 2023
Posts: 39

FlierMate2 08 May 2023, 07:09

And also, rep scas.

08 May 2023, 07:09

macomics

Joined: 26 Jan 2021
Posts: 1155
Location: Russia

macomics 08 May 2023, 07:44

FlierMate2 wrote:

And also, rep scas.

The cmps/scas commands use the prefixes repe/repne/repnz/repz. Although in fact repe/repz is the same prefix as rep

Code:

use16
rep cmpsb
repe cmpsb
repne cmpsb

Code:

~ $ fasm main.asm -m 64
flat assembler  version 1.73.30  (64 kilobytes memory)
1 passes, 6 bytes.

~ $ hexdump -C main.bin
00000000  f3 a6 f3 a6 f2 a6                                 |......|

08 May 2023, 07:44

bitRAKE

Joined: 21 Jul 2003
Posts: 4225
Location: vpcmpistri

bitRAKE 08 May 2023, 16:40

minor change makes "rep add":

Code:

mov ecx, 11
mov eax, text
mov bl, 48
@@: add [eax+ecx], bl
loop @B

... cost one more byte, and you can terminate early with Z flag (perhaps -48 sentinel with variable string length and LOOPNZ). Downside, we need additional instruction to handle ECX=0 case; whereas REP skips automatically.

Code:

        mov ecx, [length] ; dynamic
        jecxz skip
        mov eax, text
        mov bl, 48
@@:     add [eax+ecx-1], bl
        loop @B
skip:

_________________
¯\(°_o)/¯ “languages are not safe - uses can be” Bjarne Stroustrup

08 May 2023, 16:40

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20628
Location: In your JS exploiting you and your system

revolution 09 May 2023, 04:13

macomics wrote:

Although in fact repe/repz is the same prefix as rep

rep can be either repz or repnz, the choice is arbitrary. One could use this as yet another assembler signature, or to embed watermarks in output binaries.

09 May 2023, 04:13

DimonSoft

Joined: 03 Mar 2010
Posts: 1228
Location: Belarus

DimonSoft 10 May 2023, 09:43

revolution wrote:

macomics wrote:
Although in fact repe/repz is the same prefix as rep
rep can be either repz or repnz, the choice is arbitrary. One could use this as yet another assembler signature, or to embed watermarks in output binaries.

While it might work well with all known processors, is it documented anywhere so that it could be relied upon?

10 May 2023, 09:43

macomics

Joined: 26 Jan 2021
Posts: 1155
Location: Russia

macomics 10 May 2023, 10:10

DimonSoft wrote:

revolution wrote:

macomics wrote:
Although in fact repe/repz is the same prefix as rep
rep can be either repz or repnz, the choice is arbitrary. One could use this as yet another assembler signature, or to embed watermarks in output binaries.
While it might work well with all known processors, is it documented anywhere so that it could be relied upon?

Everything has already been described in great detail about these prefixes

IntelSDM-Vol. 2B 4-555 wrote:

REP/REPE/REPZ/REPNE/REPNZ—Repeat String Operation Prefix
[table][/table]
Repeats a string instruction the number of times specified in the count register or until the indicated condition of
the ZF flag is no longer met. The REP (repeat), REPE (repeat while equal), REPNE (repeat while not equal), REPZ
(repeat while zero), and REPNZ (repeat while not zero) mnemonics are prefixes that can be added to one of the
string instructions. The REP prefix can be added to the INS, OUTS, MOVS, LODS, and STOS instructions, and the
REPE, REPNE, REPZ, and REPNZ prefixes can be added to the CMPS and SCAS instructions. (The REPZ and REPNZ
prefixes are synonymous forms of the REPE and REPNE prefixes, respectively.) The F3H prefix is defined for the
following instructions and undefined for the rest:
• F3H as REP/REPE/REPZ for string and input/output instruction.
• F3H is a mandatory prefix for POPCNT, LZCNT, and ADOX.
The REP prefixes apply only to one string instruction at a time. To repeat a block of instructions, use the LOOP
instruction or another looping construct. ...

AMD 24594—Rev. 3.33—November 2021 page 12 wrote:

1.2.6 Repeat Prefixes
The repeat prefixes cause repetition of certain instructions that load, store, move, input, or output
strings. The prefixes should only be used with such string instructions. Two pairs of repeat prefixes,
REPE/REPZ and REPNE/REPNZ, perform the same repeat functions for certain compare-string and
scan-string instructions. ...

10 May 2023, 10:10

DimonSoft

Joined: 03 Mar 2010
Posts: 1228
Location: Belarus

DimonSoft 10 May 2023, 14:10

macomics, I’m afraid your quotations don’t really answer my question. I’ve read a lot of times and have re-read again before posting the article from Intel SDM. But neither it, nor the quotation from AMD SDM give any clue about repe/repne both being equal to plain rep. That’s what I’m concerned about in revolution’s suggestion.

10 May 2023, 14:10

Roman

Joined: 21 Apr 2012
Posts: 1939

Roman 10 May 2023, 15:30

POPCNT strange and useless command.
Show how bits equal\set to 1
The same result if value =0x01000000 or value =0x00000001
Funny.

10 May 2023, 15:30

macomics

Joined: 26 Jan 2021
Posts: 1155
Location: Russia

macomics 10 May 2023, 16:18

DimonSoft wrote:

macomics, I’m afraid your quotations don’t really answer my question. I’ve read a lot of times and have re-read again before posting the article from Intel SDM. But neither it, nor the quotation from AMD SDM give any clue about repe/repne both being equal to plain rep. That’s what I’m concerned about in revolution’s suggestion.

Sorry, I didn't understand that.

What revolution is talking about is rather experimental data, but there really is nothing about it in the manuals. On the contrary, there are clearly listed commands and prefixes to them.

Intel SDM wrote:

F3 REX.W 6E REP OUTS DX, r/m8* ZO Valid N.E. Output RCX bytes from [RSI] to port DX.

* In 64-bit mode, r/m8 can not be encoded to access the following byte registers if a REX prefix is used: AH, BH, CH, DH.

But in the Intel manual it is a little unclear to me here is a note to this single line.

If I'm not mistaken, then in REX there is only 1 bit defining a r/m8, and in the sequence of the command there is not even a byte mod-r/m-reg

10 May 2023, 16:18

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20628
Location: In your JS exploiting you and your system

revolution 10 May 2023, 19:29

DimonSoft wrote:

revolution wrote:

macomics wrote:
Although in fact repe/repz is the same prefix as rep
rep can be either repz or repnz, the choice is arbitrary. One could use this as yet another assembler signature, or to embed watermarks in output binaries.

While it might work well with all known processors, is it documented anywhere so that it could be relied upon?

Yes, the rep is ignored for things like rep add. It is one way of embedding arbitrary data into the code stream. There are many opportunities for embedding data, some are more subtle, and others, like rep, are more overt. It can be useful to employ many methods and see people feel smart by removing one method but failing to notice the other more subtle methods.

10 May 2023, 19:29

Roman

Joined: 21 Apr 2012
Posts: 1939

Roman 25 May 2023, 09:13

Modern cpu have many virtual registers.
How many can do parallel execute modern cpu rep scabs or stosb ?

Code:

mov ecx,7
mov edi,txt
mov al,'1' //symbol 
rep stosb 

mov ecx,7
mov edi,txt+7
mov al,'5' //symbol 
rep stosb 

mov ecx,7
mov edi,txt+14
mov al,'9' //symbol 
rep stosb

25 May 2023, 09:13

l4m2

Joined: 15 Jan 2015
Posts: 670

l4m2 01 Jun 2023, 09:04

macomics wrote:

DimonSoft wrote:

revolution wrote:

macomics wrote:
Although in fact repe/repz is the same prefix as rep
rep can be either repz or repnz, the choice is arbitrary. One could use this as yet another assembler signature, or to embed watermarks in output binaries.
While it might work well with all known processors, is it documented anywhere so that it could be relied upon?
Everything has already been described in great detail about these prefixes

IntelSDM-Vol. 2B 4-555 wrote:
REP/REPE/REPZ/REPNE/REPNZ—Repeat String Operation Prefix
[table][/table]
Repeats a string instruction the number of times specified in the count register or until the indicated condition of
the ZF flag is no longer met. The REP (repeat), REPE (repeat while equal), REPNE (repeat while not equal), REPZ
(repeat while zero), and REPNZ (repeat while not zero) mnemonics are prefixes that can be added to one of the
string instructions. The REP prefix can be added to the INS, OUTS, MOVS, LODS, and STOS instructions, and the
REPE, REPNE, REPZ, and REPNZ prefixes can be added to the CMPS and SCAS instructions. (The REPZ and REPNZ
prefixes are synonymous forms of the REPE and REPNE prefixes, respectively.) The F3H prefix is defined for the
following instructions and undefined for the rest:
• F3H as REP/REPE/REPZ for string and input/output instruction.
• F3H is a mandatory prefix for POPCNT, LZCNT, and ADOX.
The REP prefixes apply only to one string instruction at a time. To repeat a block of instructions, use the LOOP
instruction or another looping construct. ...

AMD 24594—Rev. 3.33—November 2021 page 12 wrote:
1.2.6 Repeat Prefixes
The repeat prefixes cause repetition of certain instructions that load, store, move, input, or output
strings. The prefixes should only be used with such string instructions. Two pairs of repeat prefixes,
REPE/REPZ and REPNE/REPNZ, perform the same repeat functions for certain compare-string and
scan-string instructions. ...

Nowadays a lot of instructions with F2/F3 have different meaning and 66 no longer mean 16-bit switch

01 Jun 2023, 09:04

macomics

Joined: 26 Jan 2021
Posts: 1155
Location: Russia

macomics 01 Jun 2023, 09:58

l4m2 wrote:

Nowadays a lot of instructions with F2/F3 have different meaning and 66 no longer mean 16-bit switch

In those instructions where the F2/F3 prefixes are part of the opcode, it is not necessary to use them separately.

01 Jun 2023, 09:58

< Last Thread | Next Thread >

Forum Rules:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum